We want to integrate between Salesforce communities and AWS. We have files that come and sit in Amazon S3 (reports) , a community users logins to the portal and has to access the reports.

I want to know what are the authentication mechanisms that are available for this, we dont want to use a service account/integration user approach.

Also, I checked that the username-password OAuth flow doesn't work for community users and the documentation says SAML assertion also would not work.

Other option is mutual authentication but security team is not happy with that.

Can you please let me know if any one has implemented this integration with a tight security as my client is in a regulated industry.

Any help in greatly appreciated thanks.

  • Did you ask your client whats their preferred mode of authentication? delegated?
    – RedDevil
    Feb 14 '19 at 8:40
  • Yes, the preffered mode is to use the logged in users username and password to generate a token and use it in AWS if possible.
    – Bob Gali
    Feb 14 '19 at 10:23
  • a community users logins to the portal and has to access the reports -- how is this currently implemented in your Community? Are you bringing in the reports in Salesforce or you are trying to provide Users a link in the Community to login to Amazon Services?
    – Jayant Das
    Feb 14 '19 at 14:53
  • It would be a link in the community to acess the resource - no login
    – Bob Gali
    Feb 15 '19 at 7:44

Authentication options would be dictated by AWS S3, more specifically it would depend on how you access S3.

The easiest option is S3 REST API; it requires a signature. The signature is derived from a key requested by you (the developer) from Amazon. It's possible to have a key created for each user. You have to use AWS IAM service, create IAM users and then issue keys for them. You would then have to transport these keys from AWS to Salesforce and make them available to your code in Salesforce. Last but not least you'll have to write some custom code to hit the S3 API and grab the file from the right S3 bucket. Example: Get file from AWS S3 using apex

A more out of the box solution but with considerably more complexity would be issuing SAML from Salesforce with either AWS STS or AWS Cognito as the SAML service provider, then having STS or Cognito exchange SAML for the AWS temporary credential that will hit S3. On the Salesforce side community license does allow this: https://trailhead.salesforce.com/en/content/learn/modules/identity_external/identity_external_community (The Trailhead page says you get Communities features with External Identity license but the inverse is even 'more' true - you get External Identity features with a Community license since the latter is a higher-grade license type)

Not the answer you're looking for? Browse other questions tagged or ask your own question.